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Reguirements for Address Selection Mechanisms 

Status of This Memo 
This memo provides information for the Internet community. It does 
not specify an Internet standard of any kind. Distribution of this 
memo is unlimited. 

Abstract 
There are some problematic cases when using the default address 
selection mechanism that RFC 3484 defines. This document describes 
additional requirements that operate with RFC 3484 to solve the 


problems. 
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Introduction 


Today, the RFC 3484 [RFC3484] mechanism is widely implemented in 
major OSs. However, in many sites, the default address-selection 
rules are not appropriate, and cause a communication failure. The 
problem statement (PS) document [RFC5220] lists problematic cases 
that resulted from incorrect address selection. 


Though RFC 3484 made the address-selection behavior of a host 
configurable, typical users cannot make use of that because of the 
complexity of the mechanism and lack of knowledge about their network 
topologies. Therefore, an address-selection autoconfiguration 
mechanism is necessary, especially for unmanaged hosts of typical 
users. 


This document contains requirements for address-selection mechanisms 
that enable hosts to perform appropriate address selection 
automatically. 


Requirements of Address Selection 


Address-selection mechanisms have to fulfill the following eleven 
requirements. 


1. Effectiveness 


The mechanism can modify RFC 3484 default address-selection behavior 
at nodes. As documented in the PS [RFC5220], the default rules 
defined in RFC 3484 do not work properly in some environments. 
Therefore, the mechanism has to be able to modify the address- 
selection behavior of a host and to solve the problematic cases 
described in the PS document. 


-2. Timing 


Nodes can perform appropriate address selection when they select 
addresses. 


If nodes need to have address-selection information to perform 
appropriate address selection, then the mechanism has to provide a 
function for nodes to obtain the necessary information beforehand. 


The mechanism should not degrade usability. The mechanism should not 
enforce long address-selection processing time upon users. 

Therefore, forcing every consumer user to manipulate the address- 
selection policy table is usually not an acceptable solution. So, in 
this case, some kind of autoconfiguration mechanism is desirable. 
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2.3. Dynamic Behavior Update 


The address-selection behavior of nodes can be dynamically updated. 
When the network structure changes and the address-selection behavior 
has to be changed accordingly, a network administrator can modify the 
address-—selection behavior of nodes. 


2.4. Node-Specific Behavior 


The mechanism can support node-specific address-selection behavior. 
Even when multiple nodes are on the same subnet, the mechanism should 
be able to provide a method for the network administrator to make 
nodes behave differently. For example, each node may have a 
different set of assigned prefixes. In such a case, the appropriate 
address-selection behavior may be different. 


2.5. Application-Specific Behavior 
The mechanism can support application-specific address-selection 
behavior or combined use with an application-specific address- 
selection mechanism such as address-selection APIs. 


2.6. Multiple Interface 


The mechanism can support those nodes equipped with multiple 


interfaces. The mechanism has to assume that nodes have multiple 
interfaces and makes address selection of those nodes work 
appropriately. 


2.7. Central Control 


The address-selection behavior of nodes can be centrally controlled. 
A site administrator or a service provider could determine or could 
have an effect on the address-selection behavior at their users’ 
hosts. 


2.8. Next-Hop Selection 


The mechanism can control next-hop-selection behavior at hosts or 
cooperate with other routing mechanisms, such as routing protocols 


and RFC 4191 [RFC4191]. If the address-selection mechanism is used 
with a routing mechanism, the two mechanisms have to be able to work 
synchronously. 
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2.9. Compatibility with RFC 3493 


The mechanism can allow an application that uses the basic socket 
interface defined in RFC 3493 [RFC3493] to work correctly. That is, 
with the basic socket interface the application can select 
appropriate source and destination addresses and can communicate with 
the destination host. This requirement does not necessarily mean 
that OS protocol stack and socket libraries should not be changed. 


2.10. Compatibility and Interoperability with RFC 3484 


The mechanism is compatible with RFC 3484. Now that RFC 3484 is 
widely implemented, it is preferable that a new address selection 
mechanism does not conflict with the address selection mechanisms 
defined in RFC 3484. 


If the solution mechanism changes or replaces the address-selection 
mechanism defined in RFC 3484, interoperability has to be retained. 
That is, a host with the new solution mechanism and a host with the 
mechanism of RFC 3484 have to be interoperable. 


2.11. Security 


The mechanism works without any security problems. Possible security 
threats are described in the Security Considerations section of this 
document. 

3. Security Considerations 

3.1. List of Threats Introduced by New Address-Selection Mechanism 


There will be some security incidents when combining the requirements 
described in Section 2 into a protocol. In particular, there are 3 
types of threats: leakage, hijacking, and denial of service. 


1. Leakage: Malicious nodes may tap to collect the network policy 
information and leak it to unauthorized parties. 


2. Hijacking: Nodes may be hijacked by malicious injection of 
illegitimate policy information. RFC 3484 defines both a source 
and destination selection algorithm. An attacker able to inject 
malicious policy information could redirect packets sent by a 
victim node to an intentionally chosen server that would scan the 
victim node activities to find vulnerable code. Once vulnerable 
code is found, the attacker can take control of the victim node. 
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3. Denial of Service: This is an attack on the ability of nodes to 
communicate in the absence of the address-selection policy. An 
attacker could launch a flooding attack on the controller to 
prevent it from delivering the address selection policy 
information to nodes, thus preventing those nodes from 
appropriately communicating. 


3.2. List of Recommendations in Which Security Mechanism Should Be 
Applied 


The address selection mechanism should be afforded security services 
listed below. It is preferable that these security services are 
afforded via use of ezisting protocols (e.g., IPsec). 


1. Integrity of the network policy information itself and the 
messages exchanged in the protocol. This is a countermeasure 


against leakage, hijacking, and denial of service. 


2. Authentication and authorization of parties involved in the 


protocol. This is a countermeasure against Leakage and 
Hijacking. 
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